Android-Debug-Database icon indicating copy to clipboard operation
Android-Debug-Database copied to clipboard

This library is being used by apps in production

Open nyancrimew opened this issue 5 years ago • 1 comments

I found out about this library in a sad way. I found tons of devices with it exposed on :8080 on shodan, and tracked down a couple of (big) apps using it in production. (read here: https://deletescape.ch/posts/how-to-leak-all-user-data/)

My suggestion here would be to actually prevent the library from working at all in non-debug builds (potentially adding an override flag for locally debugging prod builds), so this cannot happen by accident. I know that the docs in this repo make it very clear to use it only on debug builds and how to achieve that, and I put no blame on you, but I think it is important to try and prevent this from happening again in every way possible.

nyancrimew avatar Dec 29 '19 10:12 nyancrimew

Hey, @deletescape Yes, It is clearly mentioned in the document. Use debugImplementation so that it will only compile in your debug build and not in your release build. Yes, of course, we can add the extra flag to prevent this.

amitshekhariitbhu avatar Dec 29 '19 11:12 amitshekhariitbhu